From 835b2fba9c7beb45221962f0b5615a516a3548e9 Mon Sep 17 00:00:00 2001
From: Daniel Hougaard <daniel@infisical.com>
Date: Thu, 1 May 2025 18:02:27 +0400
Subject: [PATCH] requested changes

---
 .github/workflows/release_docker_gateway.yaml |  3 +--
 .github/workflows/release_helm_gateway.yaml   |  2 +-
 Dockerfile.gateway                            |  2 +-
 .../templates/deployment.yaml                 |  8 +++---
 .../infisical-gateway/templates/secret.yaml   | 13 ++++++++++
 helm-charts/infisical-gateway/values.yaml     | 26 +++++++++++++------
 6 files changed, 37 insertions(+), 17 deletions(-)
 create mode 100644 helm-charts/infisical-gateway/templates/secret.yaml

diff --git a/.github/workflows/release_docker_gateway.yaml b/.github/workflows/release_docker_gateway.yaml
index 666b2c46c..da1e105e3 100644
--- a/.github/workflows/release_docker_gateway.yaml
+++ b/.github/workflows/release_docker_gateway.yaml
@@ -6,7 +6,6 @@ on:
 
 permissions:
     contents: write
-    pull-requests: write
 
 jobs:
     release-image:
@@ -18,7 +17,7 @@ jobs:
               run: echo "::set-output name=version::${GITHUB_REF_NAME#infisical-gateway/}"
 
             - name: Checkout code
-              uses: actions/checkout@v2
+              uses: actions/checkout@v4
 
             - name: 🔧 Set up QEMU
               uses: docker/setup-qemu-action@v1
diff --git a/.github/workflows/release_helm_gateway.yaml b/.github/workflows/release_helm_gateway.yaml
index 466849a2d..1b067bd73 100644
--- a/.github/workflows/release_helm_gateway.yaml
+++ b/.github/workflows/release_helm_gateway.yaml
@@ -8,7 +8,7 @@ jobs:
         runs-on: ubuntu-latest
         steps:
             - name: Checkout
-              uses: actions/checkout@v2
+              uses: actions/checkout@v4
 
             - name: Install Helm
               uses: azure/setup-helm@v3
diff --git a/Dockerfile.gateway b/Dockerfile.gateway
index dd4b3f0fe..24c03e3e0 100644
--- a/Dockerfile.gateway
+++ b/Dockerfile.gateway
@@ -7,7 +7,7 @@ COPY ./cli .
 
 RUN go build -o infisical-cli .
 
-FROM alpine:latest
+FROM alpine:3.19
 
 ENV TOKEN=""
 ENV INFISICAL_API_URL="https://app.infisical.com"
diff --git a/helm-charts/infisical-gateway/templates/deployment.yaml b/helm-charts/infisical-gateway/templates/deployment.yaml
index 99b107ef5..636e88d35 100644
--- a/helm-charts/infisical-gateway/templates/deployment.yaml
+++ b/helm-charts/infisical-gateway/templates/deployment.yaml
@@ -37,11 +37,9 @@ spec:
           {{- end }}
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
           imagePullPolicy: {{ .Values.image.pullPolicy }}
-          env:
-          {{- range $key, $value := .Values.env }}
-            - name: {{ $key }}
-              value: {{ $value | quote }}
-          {{- end }}
+          envFrom:
+            - secretRef:
+                name: {{ .Values.secret.name }}
           ports:
             - name: http
               containerPort: {{ .Values.service.port }}
diff --git a/helm-charts/infisical-gateway/templates/secret.yaml b/helm-charts/infisical-gateway/templates/secret.yaml
new file mode 100644
index 000000000..f186b8ec4
--- /dev/null
+++ b/helm-charts/infisical-gateway/templates/secret.yaml
@@ -0,0 +1,13 @@
+{{- if .Values.secret.create -}}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Values.secret.name }}
+  labels:
+    {{- include "infisical-gateway.labels" . | nindent 4 }}
+type: Opaque
+data:
+  {{- range $key, $value := .Values.secret.data }}
+  {{ $key }}: {{ $value | b64enc }}
+  {{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/helm-charts/infisical-gateway/values.yaml b/helm-charts/infisical-gateway/values.yaml
index e2bb8e9ad..bb63a82a8 100644
--- a/helm-charts/infisical-gateway/values.yaml
+++ b/helm-charts/infisical-gateway/values.yaml
@@ -1,16 +1,22 @@
 image:
   repository: infisical/infisical-gateway
   pullPolicy: IfNotPresent
-  tag: "latest"
+  tag: "v0.0.1"
 
-# Environment variables for the gateway
-env:
-  TOKEN: ""
-  INFISICAL_API_URL: "https://app.infisical.com/api"
+secret:
+  # create a new secret (if true) or use existing (if false)
+  create: true
+  # name of the secret to use/create
+  name: "infisical-gateway-secrets"
+
+  # Secret data (only used if create: true)
+  data:
+    TOKEN: ""
+    INFISICAL_API_URL: "https://app.infisical.com"
 
 resources:
   limits:
-    cpu: 100m
+    cpu: 500m
     memory: 128Mi
   requests:
     cpu: 100m
@@ -28,8 +34,12 @@ serviceAccount:
 
 podAnnotations: {}
 podLabels: {}
-podSecurityContext: {}
-securityContext: {}
+podSecurityContext:
+  runAsNonRoot: true
+
+securityContext:
+  runAsNonRoot: true
+
 affinity: {}
 tolerations: {}
 nodeSelector: {}